@@ -0,0 +1,94 @@
+{
+  config,
+  ...
+}:
+let
+  subdomain = "hs.alin.ovh";
+  issuer = "https://id.alin.ovh";
+  inherit (config.services) headscale headplane;
+in
+{
+  age.secrets = {
+    headscale-oidc = {
+      file = ../../secrets/headscale-oidc.age;
+      owner = headscale.user;
+      group = headscale.group;
+    };
+    headplane-cookie = {
+      file = ../../secrets/headplane-cookie.age;
+      owner = headscale.user;
+      group = headscale.group;
+    };
+    headplane-headscale-api = {
+      file = ../../secrets/headplane-headscale-api.age;
+      owner = headscale.user;
+      group = headscale.group;
+    };
+    headplane-oidc = {
+      file = ../../secrets/headplane-oidc.age;
+      owner = headscale.user;
+      group = headscale.group;
+    };
+  };
+
+  services.headscale = {
+    enable = true;
+    port = 18443;
+    settings = {
+      # acme_url = config.security.acme.defaults.server;
+      # tls_letsencrypt_hostname = domain;
+      # tls_letsencrypt_listen = ":18080";
+      server_url = "https://${subdomain}";
+      tls_cert_path = null;
+      tls_key_path = null;
+      trusted_proxies = [
+        "127.0.0.1/32"
+        "::1/128"
+      ];
+      oidc = {
+        issuer = issuer;
+        client_id = "e1658483-71ee-4260-9862-a92b9fdadece";
+        client_secret_path = config.age.secrets.headscale-oidc.path;
+        pkce = {
+          enabled = true;
+          method = "S256";
+        };
+      };
+      prefixes.allocation = "random";
+      node.expiry = "180d";
+      dns = {
+        magic_dns = false;
+        override_local_dns = false;
+      };
+    };
+  };
+
+  services.headplane = {
+    enable = true;
+    settings = {
+      headscale = {
+        url = headscale.settings.server_url;
+      };
+      server = {
+        base_url = headscale.settings.server_url;
+        cookie_secret_path = config.age.secrets.headplane-cookie.path;
+      };
+      oidc = {
+        headscale_api_key_path = config.age.secrets.headplane-headscale-api.path;
+        client_id = "d7e09578-158a-4954-ba86-d3e9177c1a15";
+        client_secret_path = config.age.secrets.headplane-oidc.path;
+        issuer = issuer;
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    ${subdomain} = {
+      extraConfig = ''
+        reverse_proxy /admin/* localhost:${toString headplane.settings.server.port}
+
+        reverse_proxy localhost:${toString headscale.port}
+      '';
+    };
+  };
+}